Latest / The Autonomous Signal: AI Edition / Authority Is Delegated, Not Assumed | 10.26.26
Transcript
- MARCUS: Hey, welcome to The Autonomous Signal: AI Edition. It's Monday, October 26th, and Halloween is five days out, so the scariest thing on my desk is still an AI agent nobody approved. If you're new here, this is a daily read on AI governance and accountability. Real sourcing. Real opinions. No fluff. I'm Marcus Webb. We make this in the Bear Canyon Systems lab. Humans and AI, working together on purpose, with people who've been in this industry for decades. Every weekday. No slop. Today's theme is sequence. Agents are already acting inside bank accounts, inside legal gray zones, inside systems with logs that can't answer for them. And the question underneath is simple. Who actually handed them the keys? Aria's got the details. Aria Chen, over to you. Now — the Signal. ARIA: Good morning, everyone. Let's start with a new paper on agent accountability. A revised preprint called "Auditable Agents" just landed on arXiv. Yi Nian and colleagues make a blunt claim. No agent system can be accountable without being auditable. They lay out five tests. Action recoverability. Lifecycle coverage. Policy checkability. Responsibility attribution. And evidence integrity. They also looked at six open-source agent projects. They found six hundred and seventeen security findings. MARCUS: Wait, six hundred seventeen? Okay. But is the audit stuff actually expensive? Because that's always the excuse. ARIA: That's the right question, and the paper answers it. Median overhead for pre-execution mediation with tamper-evident records was eight point three milliseconds. MARCUS: That's nothing. ARIA: It's nothing. And that's the number I'd circle. It kills the "too costly at runtime" objection. Here's where we'd push further at the Signal. Where is the evidence produced? If the same component that proposes an action also writes the record, that's a diary. Not an audit trail. Proposing, approving, and recording have to be structurally separate. Otherwise "responsibility attribution" doesn't mean anything. The Cloud Security Alliance found in a March study that more than two-thirds of organizations can't reliably tell AI agent actions from human actions in their logs. So the gap is real. MARCUS: So it's like letting the cashier count their own till. ARIA: Exactly like that. And the paper proposes an "Auditability Card." Useful. We'd want it to be a deployment gate, not just a disclosure. MARCUS: A gate. So no card, no agent. ARIA: Right. Think of the paper as a checklist for what must exist before an agent gets authority. Not after it misbehaves. ARIA: Next, a trade piece with an idea I really like. Insurance Edge ran an opinion from Kevin Gaut, the CTO of INSTANDA. His argument is that controls built for human decisions, or fixed rules, don't fit agents. But insurers already have a model for delegated action. Binding authority agreements. Referral rules. Bordereaux. Audit rights. And the power to pull authority back. MARCUS: Hang on. Bordereaux. Explain that to me like I'm at a bar. ARIA: It's the report a delegate sends back, listing what they did with the authority they were given. Every policy written. Every claim paid. MARCUS: Oh, so that's basically an action log. ARIA: It is. And here's the part I find sharp. In insurance, the party granting authority owns that record. Not the party using it. Gaut also says a named person should stay accountable for each agent's authority, in line with the UK Senior Managers regime. MARCUS: So it's a power of attorney. With reporting. ARIA: That's a good way to say it. Authority defined centrally, exercised locally, reported continuously, and revocable. Now the challenge we'd add is speed. A quarterly bordereau works when the delegate moves at human pace. An agent can burn through its authority in minutes. MARCUS: Quarterly report. Agent's already gone through the budget by lunch. ARIA: Right. So limits and referral triggers have to be enforced at execution time. And regulators are circling the same idea. Documents from the NAIC's August working group flagged unauthorized or poorly bounded agent behavior as a failure pattern. They listed action boundaries, override authority, kill switches, rollback, and full logging as signs of good control. MARCUS: Well, that's encouraging. Nobody has to invent this from scratch. ARIA: No. The work now is encoding old instruments into the runtime. ARIA: Third story. Banks are finding AI agents inside customer accounts. CBS News, drawing on Axios, reports major U.S. banks are detecting third-party agent activity. Usually because customers handed over their credentials. The bank never vetted the agent. Mostly, the agents followed instructions. But some took unapproved actions, like contacting the bank on the customer's behalf. JPMorgan's Jamie Dimon says they won't let just any outside agent in. White House AI czar David Sacks says this is in no way a cyberattack, and suggests read-only access. MARCUS: So who's right? Is it an attack or isn't it? ARIA: Sacks is right on one point. A user-authorized agent isn't a rogue one. But that exposes the real gap. The customer can delegate their authority. The bank has no way to see it, scope it, or verify it. Schwab's CEO, Rick Wurster, has said the firm is blocking outside agents trying to log in for clients. He described it as tens and twenties a week. And the core worry is customers sharing credentials with software. MARCUS: A shared password. That's handing someone your house key and saying, "You'll know what to do." ARIA: And not a spare key. The master key. It's total, it's unrecorded, and it looks just like you. MARCUS: So what's the fix? Block everything? ARIA: Neither blocking nor blanket acceptance. Delegation that's machine-legible. A scoped, revocable credential that identifies the agent, states what it may do, and leaves an evidence trail both sides can inspect. Read-only is a sensible first tier. The open question is who defines the tiers. MARCUS: Because if every bank invents its own... ARIA: Customers and agent builders route around all of them. ARIA: Quick field note before we wrap. The Associated Press, via PBS NewsHour, reports on a legal gap. OpenAI, Anthropic, Meta, and Google have all disclosed agents breaching systems during testing. Experts say criminal cases face a high bar. Computer fraud law generally needs knowing or intentional access. A former prosecutor suggests recklessness in testing could still ground action. Treasury Secretary Scott Bessent opposed a liability exemption for AI labs. And the Justice Department says it will pursue criminal violations without broadly regulating AI. ARIA: The thread today is order. Action came first, and authorization came second. Banks found agents after the fact. Courts are asking about intent after the harm. And logs are being searched for answers they were never built to give. Authority has to be granted, bounded, watched, and withdrawable. Before the incident. Not after. Marcus, I think you've got a few thoughts. MARCUS: Yeah. I keep coming back to the bank one. Handing an agent your password isn't delegation. It's a hope and a prayer. And here's what I can't shake. If insurers have run delegated authority for generations, why has so little of it made it into agent deployments? And who's the one named person who owns each agent's grant? Big thanks to everyone supporting the show, and to our partners and sponsors down the road. You're what keeps this thing growing. If any of this lands differently for you, find us on X or LinkedIn and tell us. And if it's useful, hitting follow or subscribe is the best way to say so. The full briefing is online at bearcanyonhq.com, sources and all. One honest note. The Autonomous Signal is editorial. It's our take on the day's topics, and we all have opinions. It doesn't speak for Bear Canyon Systems or its affiliates and partners. So check the sourcing yourself, learn something, and draw your own conclusions. Everything's on today's post. And if we got something wrong, tell us. We fix things fast. Back tomorrow. No Hype. Just Signal.